1{den, ...}: {
 2  den.aspects.core.security.includes = [den.aspects.core.security.auth];
 3  den.aspects.core.security.auth = {
 4    nixos = {
 5      security.sudo = {
 6        enable = true;
 7        extraRules = [
 8          {
 9            commands =
10              map
11              (command: {
12                command = "/run/current-system/sw/bin/${command}";
13                options = ["NOPASSWD"];
14              })
15              [
16                "poweroff"
17                "reboot"
18              ];
19            groups = ["wheel"];
20          }
21        ];
22      };
23
24      security.pam.services.su.requireWheel = true;
25    };
26  };
27}